CVE-2026-35273Vulnerability
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Reported by 10 independent sources · first reported by Google Threat Intelligence · last reported
Last reported 12 days ago
Fix due 15 Jun 2026
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 18 Oct 2026
What the reports say
17 reports, newest first · the exact sentence from each-
September 2026 CVE Landscape“…eporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems.”
-
ShinyHunters Extorted Boeing Spin-off Prior to Arrests“As noted in our September 28 report, ShinyHunters gained access to the FBI site and other victims by exploiting a vulnerability (CVE-2026-35273) in PeopleSoft, a software-as-a-service platform from the tech giant Oracle that is broadly used by companies to manage hiring and human…”
-
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach“According to a report from Google-owned Mandiant, ShinyHunters is assessed to be exploiting a bypass for CVE-2026-35273 by using a URL-encoding trick to get around a web application firewall (WAF) rule designed to block the vulnerable Environment Management Hub (PSEMHUB) endpoint…”
-
Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation“ShinyHunters hacked the FBI jobs site, likely using a modified exploit for CVE-2026-35273, the Oracle PeopleSoft vulnerability, which the group exploited as a zero-day in June, and included an oversized Umbreon Pokémon image in the site’s defacement.”
-
Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation“…t's now assessed that ShinyHunters employed a URL-encoding trick to bypass web application firewall (WAF) rules designed to mitigate CVE-2026-35273.”
-
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation“ShinyHunters said it gained access to the FBI site and other victims by exploiting a recently patched vulnerability (CVE-2026-35273) in PeopleSoft, a software-as-a-service platform from the software giant Oracle that is broadly used by companies to manage hiring and human resourc…”
-
FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day“Renewed exploitation of CVE-2026-35273”
-
Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign“Google’s warning comes four months after the hacking group was seen exploiting a zero-day vulnerability in PeopleSoft, tracked as CVE-2026-35273, to gain remote code execution without authentication.”
-
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells“The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution.”
-
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft“…or with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors.”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“Google's Threat Intelligence Group identified an active compromise and extortion campaign, attributed to ShinyHunters, exploiting CVE-2026-35273.”
-
ShinyHunters Claims Access to FBI Systems“Between May and June 2026, activity attributed to UNC6240, associated with ShinyHunters, exploited CVE-2026-35273, a critical unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools.”
-
ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants“However, ShinyHunters weaponized a similar flaw (CVE-2026-35273) in June 2026 to break into enterprise networks and extort victims.”
-
Exploits and vulnerabilities in Q2 2026“CVE-2026-35273: a vulnerability in Oracle PeopleSoft PeopleTools that security vendors classify as server-side request forgery (SSRF).”
-
June 2026 CVE Landscape“CVE-2026-35273”
-
PeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVM“Oracle assigned CVE-2026-35273 (CVSS 9.8) and released an out-of-band patch on June 10, 2026.”
-
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit“The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273, a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component.”
Indicators reported together
named in the same reports- fbijobs[.]govin 4 reports
- apply.fbijobs[.]govin 4 reports
- azurenetfiles[.]netin 3 reports
- 162.219.30[.]165in 2 reports
- 142.11.200[.]186in 2 reports
Copy these 5 indicators · defanged
Also named with it: CVE-2025-8088, CVE-2025-6218, CVE-2022-0847, CVE-2026-65660, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2024-21762, CVE-2016-4437, CVE-2026-60004, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230
Thanks — we review every report.